Priority HIGH 77
OpenCart Core 4.0.2.3 contains a SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the 'search' parameter.
CVSS 4.0HIGH 8.8· Network · No auth · No interaction · EPSS 0.00344 · Published 2026-03-25 · Fixed in 4.1.0.0 CWE-89
Priority MEDIUM 56
A vulnerability has been found in OpenCart 4.0.2.3.
CVSS 4.0MEDIUM 5.1· Network · High privileges · No interaction · EPSS 0.00296 · Published 2026-03-08 · No fix listed CWE-1336
Priority MEDIUM 61
A security flaw has been discovered in OpenCart up to 4.1.0.3.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.00407 · Published 2025-12-28 · No fix listed CWE-362
Priority LOW 27
OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via SVG file uploads used in blog posts.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0028 · Published 2025-07-25 · No fix listed CWE-79
Priority LOW 27
OpenCart version 4.1.0.4 is vulnerable to a Stored Cross-Site Scripting (XSS) attack via the blog editor.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.0028 · Published 2025-07-25 · No fix listed CWE-79
Priority LOW 21
HTML injection vulnerabilities in OpenCart versions prior to 4.1.0.
CVSS 3.1MEDIUM 4.7· Network · No auth · User interaction · EPSS 0.00257 · Published 2025-02-28 · Fixed in 4.1.0 CWE-79
Priority LOW 21
HTML injection vulnerabilities in OpenCart versions prior to 4.1.0.
CVSS 3.1MEDIUM 4.7· Network · No auth · User interaction · EPSS 0.00257 · Published 2025-02-28 · Fixed in 4.1.0 CWE-79
Priority LOW 21
HTML injection vulnerabilities in OpenCart versions prior to 4.1.0.
CVSS 3.1MEDIUM 4.7· Network · No auth · User interaction · EPSS 0.00257 · Published 2025-02-28 · Fixed in 4.1.0 CWE-79
Priority LOW 27
Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00233 · Published 2025-02-28 · Fixed in 4.1.0 CWE-79
Priority HIGH 67
OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00923 · Published 2024-12-18 · No fix listed CWE-94
Priority MEDIUM 44
This affects versions of the package opencart/opencart from 4.0.0.0 and before 4.1.0.0.
CVSS 4.0LOW 2.1· Network · No auth · User interaction · EPSS 0.00366 · Published 2024-06-22 · Fixed in 4.1.0.0 CWE-79
Priority HIGH 67
This affects versions of the package opencart/opencart from 4.0.0.0.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00719 · Published 2024-06-22 · No fix listed CWE-20
Priority HIGH 68
This affects versions of the package opencart/opencart from 0.0.0.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.1908 · Published 2024-06-22 · No fix listed CWE-89
Priority HIGH 67
This affects versions of the package opencart/opencart from 4.0.0.0.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.14126 · Published 2024-06-22 · No fix listed CWE-29
Priority MEDIUM 44
This affects versions of the package opencart/opencart from 4.0.0.0.
CVSS 4.0LOW 2.1· Network · No auth · User interaction · EPSS 0.00391 · Published 2024-06-22 · No fix listed CWE-79
Priority MEDIUM 44
This affects versions of the package opencart/opencart from 4.0.0.0.
CVSS 4.0LOW 2.1· Network · No auth · User interaction · EPSS 0.00366 · Published 2024-06-22 · No fix listed CWE-79
Priority HIGH 73
An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having common/security write privilege can write arbitrary untrusted data inside config.php and admin/config.php, resulting in remote…
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01779 · Published 2023-11-15 · No fix listed CWE-94
Priority HIGH 71
Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 allows an authenticated user with access/modify privilege on the Log component to empty out arbitrary files on the server
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01037 · Published 2023-09-26 · Fixed in 4.0.2.3 CWE-20
Priority HIGH 82
OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthenticated attackers to gain access to the application via a brute force attack to the…
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01288 · Published 2023-09-12 · No fix listed CWE-307
Priority LOW 36
SQL injection vulnerability in OpenCart v.2.2.00 thru 3.0.3.2 allows a remote attacker to execute arbitrary code via the Fba plugin function in upload/admin/index.php.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.01127 · Published 2023-06-20 · No fix listed CWE-89
Priority MEDIUM 56
OpenCart 3.0.3.7 allows users to obtain database information or read server files through SQL injection in the background.
CVSS 3.1MEDIUM 4.9· Network · High privileges · No interaction · EPSS 0.00875 · Published 2022-11-03 · No fix listed CWE-89
Priority LOW 38
In OpenCart 1.4.7 to 1.5.5.1, implemented anti-traversal code in filemanager.php is ineffective and can be bypassed.
CVSS 3.1MEDIUM 6.5· Network · High privileges · No interaction · EPSS 0.06579 · Published 2022-06-24 · No fix listed CWE-22
Priority LOW 25
OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.01711 · Published 2020-12-29 · No fix listed CWE-79
Priority LOW 25
OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image.
CVSS 3.1MEDIUM 4.8· Network · High privileges · User interaction · EPSS 0.01273 · Published 2020-12-29 · No fix listed CWE-79
Priority LOW 17
Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd.
CVSS 3.1LOW 3.5· Network · Low privileges · User interaction · EPSS 0.00389 · Published 2020-12-11 · No fix listed CWE-352
Load more
THREATIST.IORead the docs